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JJ the permissions listed in this file are those needed by phase 1 bootstrap 


[ view: [TS a 17 and veb-tier (error jsp page) logic 


Welcome //f permissions to create PRMiniLoader/PRBasaLoader/PRAppLoader/PRClassLoaderDa and associate permissions to loaded dasses 
permission java.lang.RuntimePermission "createClassLoader'; 
permission java.lang.RuntimePermizzion "gatClaszLoadar'; 
any permission Java.lang.RuntimePermission "getProtectionDomain"s 
permission java. security. SecurityPermizzion "aetPolicy"; 


5 Applications 
œ Uf the following needed by RetroWesver when running with Java 1.4.2 

permission java.lang.reflect.ReflectPermission "suppressaccesschacks"s 

permission javs.lang.RuntimePermission “sccessDedsredMembers", 


WebSphere enterprize applica Uf Permissions to register miniboot MBean 

Business-level appl permission javax.management.MBeanServerPermizzion “weateMBeanServer": 
aes permission Javax.management.MBeanTrustPermission "registe, 

ges] permission javax.mansgement, MBeanPermission "com. pega *W*[ 'egisterMBe an"; 
Global deployment zettingz 
17 permissions for java,util-logging and character encoding 
# Jobs permission java. lang.RuntimePermission "accessClaszInPackage.sun.vtil.logging.resources*; 

" permission Java.util.logging.LoggingPermission "control", ""; // - BaseLogger sets log level for specific classes 
+ Services 

// permissions granted to PRBaseLoader, PRAppLoader and other URL-based dassloaders vithin PagaRULES to 

< Resources. if avoid a security exception being reported in the console log when the respective classloader constructor is invoked, The 

ff PRBaceLoader and PRAppLoadar are explictly coded to avoid dass sharing via this mechanism in the IBM JVM but there iz 
< Security // no mechanism provided by IBM for programatically disabling the use of shared dasses in à classloader that 

if extends URLClazsLoader. 

permission com. ibm. oti. shared SharedClassPermission "com.paga.pegarules.internal.bootstrap.phasez.PRBaseLoader", 
permission com.ibm,oti, shared, SharedClassPermission "com.pega.pegai 

permission com.ibm.otl. shared, SharadClassPermission "com.pega. apache. 

) 11 For 18M JVM, prrulesecurity needs to introspect dass to add permission 

Gece and rena permission java.lang.RuntimePermizzion "accessClaszInPackage.com.ibm.cti. shared"; 


F Environment 
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< System administration i 
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# Troubleshooting 11 the following needed for server identification display 
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1 the following are the minimum permissions need for access to JSP dtd and xsd resources 
* UDOT ff and Java compilation - needed only if the above permission iz not granted (in which 

í case a security exception will be shown, but can be ignored, during probe for server 

if identification information). 

permission Java.io.FiloPermission "t (vas.install.root 4 (/Hib*, "« 
permission java.io,FilePermission "4{was.install.root}$4/ Hibs). 
permizzion java.io.FlleParmizzion "$ (vaz.inztall.root)$ (/)pluginz", " 
permission java.io,FilePermission "{was.install.root}44/ plugins $4 


Uf Websphere establishes a protection domain based on the Jar file in which the 
U1 dass performing the operation resides, and does not grant permission to 

fi raad othar jar filas under the deployment. The following addresses that issue. 

permission java.io.FilePermission "${spp.installed.path}", "re {Í IMPLIED by vas.install.root read permission 
permission Java.io.FilaParmission "$(app-installed path) £/)- "read"; // IMPLIED by was.installroot read permission 


T: 
// One cannot grant permissions to code outside of the deployed application vis the WAS policy 


// fila. PRClassLoader uses a sat of hard-coded permissions for all (assembled/generated) code 
if loaded by it, This set may be augmented with a site-specific set of permissions, 
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